INTRO
A public contact form without defenses becomes a spam inbox. Buyers also abandon forms that feel hostile. Balance is the job: validate hard, friction light for humans.
Validate on the server
Shared Zod (or similar) schemas for client and API route. Min lengths that reject garbage, max lengths that block paste bombs.
Return field errors cleanly — do not 500 on bad input.
Spam layers
Honeypot fields, basic rate limits per IP, and optional CAPTCHA only when abuse appears. Start simple; escalate with evidence.
Log delivery success separately from “HTTP 200 on the handler.”
Conversion UX
Thank-you routes should be `noindex`. Show clear success and expected reply time.
Track submit events in analytics when GA is present — not on the LCP path.
KEY TAKEAWAYS
“Server validation is mandatory.”
- 02
Layer spam defenses; do not punish users first.
- 03
Confirm delivery, then thank-you.
CONCLUSION
Closing thought
Need a production-grade contact flow on Next.js? Discuss requirements on Contact — yes, the irony is intentional.
CONTINUE
Related pages
UP NEXT
How I Ship a SaaS MVP on Next.js (Realistic Timeline)
A practical timeline for a production-minded SaaS MVP on Next.js — scope cuts, staging from week one, and what I refuse to fake.
Read next article